imageI needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task  in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

In my case this returns the value -78624000000000 but how do we interpret this?

The value is expressed in 100 nanosecond units which is the same unit as a windows FILETIME structure uses.

Knowing that we can use the FromTicks method from the .NET TimeSpan structure to convert it to the number of days:

And $maxPwdDays is 91 in my case.

Note that I am using ABS to make the value positive since maxPwdAge is always negative.